2 lines
3.1 KiB
JSON
2 lines
3.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"7.0.0.87","status":"affected","version":"7.0.0","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*","matchCriteriaId":"C1EFBD0F-9664-4EF3-9908-C72B1318F68F","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser.\n\nThis vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking."},{"lang":"es","value":"Una vulnerabilidad de cross-site scripting (XSS) reflejado existe en el flujo de registro de cuentas de WSO2 Identity Server debido a una codificación de salida incorrecta. Un actor malicioso puede explotar esta vulnerabilidad inyectando una carga útil manipulada que se refleja en la respuesta del servidor, permitiendo la ejecución de JavaScript arbitrario en el navegador de la víctima.\n\nEsta vulnerabilidad podría permitir a los atacantes redirigir a los usuarios a sitios web maliciosos, modificar la interfaz de usuario o exfiltrar datos del navegador. Sin embargo, las cookies sensibles relacionadas con la sesión están protegidas usando la bandera httpOnly, lo que mitiga el riesgo de secuestro de sesión."}],"id":"CVE-2025-0209","lastModified":"2026-10-11T20:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0209","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-09-23T18:30:48.378651Z","version":"2.0.3"}}]},"published":"2025-09-23T18:15:29.833","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":["Vendor Advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3902/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|